{ ... }:
{
  imports = [ ./acme.nix ];
  services.jellyfin.enable = true;

  services.nginx = {
    enable = true;
    virtualHosts."jellyfin.sorre.xyz" = {
      forceSSL = true;
      enableACME = true;

      # NOTE: These are the default ports, don't change them in the web UI or
      # the nginx config will break
      locations = {
        "/" = {
          proxyPass = "http://localhost:8096";
          recommendedProxySettings = true;
          extraConfig = ''
            # Disable buffering when the nginx proxy gets very resource heavy
            # upon streaming
            proxy_buffering off;
          '';
        };

        # Proxy Jellyfin Websockets traffic
        "/socket" = {
          proxyPass = "http://localhost:8096";
          recommendedProxySettings = true;
        };
      };

      extraConfig = ''
        # The default `client_max_body_size` is 1M, this might not be enough
        # for some posters, etc.
        client_max_body_size 20M;

        # NOTE: X-Frame-Options may cause issues with the webOS app
        add_header X-Frame-Options "SAMEORIGIN";
        add_header X-Content-Type-Options "nosniff";

        # COOP/COEP. Disable if you use external plugins/images/assets
        add_header Cross-Origin-Opener-Policy "same-origin" always;
        add_header Cross-Origin-Embedder-Policy "require-corp" always;
        add_header Cross-Origin-Resource-Policy "same-origin" always;

        # Permissions policy. May cause issues on some clients
        add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;

        # Content Security Policy
        # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
        # Enforces https content and restricts JS/CSS to origin
        # External Javascript (such as cast_sender.js for Chromecast) must be whitelisted.
        # NOTE: The default CSP headers may cause issues with the webOS app
        add_header Content-Security-Policy "default-src https: data: blob: http://image.tmdb.org; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'";
      '';
    };
  };
}